CVE-2026-52772 in YesWiki

Resumen

por MITRE • 2026-09-05

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: GitHub M
• Reservar: 2026-06-08
• Divulgación: 2026-09-05
• Moderación: aceptado
• Artículo: VDB-399207
• CPE: listo
• CWE: CWE-79 (confirmado)
• CVSS: 5.5 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: medio
• Sector: Lawfirm, Agriculture, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-52772
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52772
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-52772/